Nokogiri does not forbid namespace nodes in XPointer ranges
xpointer.c in libxml2 before 2.9.5 (as used in nokogiri before 1.7.1 amongst other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2016-4658US | critical9.8 | — | ||
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.htmlWEB
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.htmlWEB
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.htmlWEB
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.htmlWEB
- https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344bWEB
- https://nvd.nist.gov/vuln/detail/CVE-2016-4658ADVISORY
- https://security.gentoo.org/glsa/201701-37WEB
- https://support.apple.com/HT207141WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan